binaryedge.ninja, as data

## Important clarificationBeing scanned does **not** necessarily mean Coalition believes your organization has been compromised.More commonly, it means your systems are **internet-facing**, and Coalition is collecting the same type of exposure data needed to understand what is visible externally and whether any of that exposure may create risk.## What the scanner doesThe BinaryEdge scan engine performs automated scanning of the **public internet** and looks for systems and services that are exposed to the internet.In practice, this means the scanner is designed to identify things such as:* **Exposed services and protocols*** **Service metadata** that helps identify what is running on an internet-facing system* **Technology, device, or version indicators** such as CPE data when availableCoalition does **not** rely on scanning every possible port on the internet. Instead, the scanning program is focused on the ports threat actors are most likely to target, with coverage across **hundreds of important ports** based on attacker activity, newly disclosed vulnerabilities, and research signals.## Why Coalition collects this dataCoalition uses the data to understand **external attack surface exposure** and support cyber security use cases such as:* Identifying internet-facing services that may present risk* Enriching external asset and service visibility with protocol and technology details* Prioritizing issues on services and ports that attackers are actively targeting* Helping cyber insurance policyholders and customers reduce the likelihood of security incidents and claims## Why your organization may appear in scansYour organization may be scanned if you have **public IP addresses, services, or applications that are reachable from the internet**.